Description
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://www.debian.org/security/2019/dsa-4387 ↗
- https://usn.ubuntu.com/3885-1/ ↗
- https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2 ↗
- https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h ↗
- https://security.netapp.com/advisory/ntap-20190215-0001/ ↗
- http://www.securityfocus.com/bid/106531 ↗
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt ↗
- https://security.gentoo.org/glsa/201903-16 ↗
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html ↗
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html ↗
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html ↗
- https://access.redhat.com/errata/RHSA-2019:3702 ↗
- https://security.gentoo.org/glsa/202007-53 ↗
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf ↗